@@ -0,0 +1,64 @@ |
| | 1 | +-- SPDX-License-Identifier: AGPL-3.0-or-later |
| | 2 | +-- |
| | 3 | +-- OpenPGP public keys associated with users. Used to verify the |
| | 4 | +-- signature on a commit or annotated tag and render the "Verified" |
| | 5 | +-- badge. Companion table user_gpg_subkeys (0067) carries the per- |
| | 6 | +-- subkey reverse-lookup index that the verification hot path joins |
| | 7 | +-- against — a commit signature carries the *subkey's* fingerprint, |
| | 8 | +-- not the primary's. |
| | 9 | +-- |
| | 10 | +-- fingerprint is unique across ALL users (partial index, where |
| | 11 | +-- revoked_at is null) — two users registering the same key would |
| | 12 | +-- produce ambiguous verification lookups. Soft-delete via revoked_at |
| | 13 | +-- preserves audit history and lets re-upload of the same fingerprint |
| | 14 | +-- after revoke succeed. |
| | 15 | +-- |
| | 16 | +-- armored holds the ASCII-armored block exactly as uploaded so we |
| | 17 | +-- can round-trip it back over REST and email; the parsed capability |
| | 18 | +-- flags + uids + subkey metadata are decoded once at insert time |
| | 19 | +-- and stored alongside so the REST response doesn't re-parse on read. |
| | 20 | +-- |
| | 21 | +-- can_encrypt_comms vs can_encrypt_storage split per RFC 4880 |
| | 22 | +-- §5.2.3.21 to match GitHub's /user/gpg_keys response shape exactly. |
| | 23 | +-- can_authenticate is stored but not surfaced over REST in S51 |
| | 24 | +-- (GitHub doesn't surface it either; the column lets S52/S53 expose |
| | 25 | +-- it later without a schema change). |
| | 26 | + |
| | 27 | +-- +goose Up |
| | 28 | +CREATE TABLE user_gpg_keys ( |
| | 29 | + id bigserial PRIMARY KEY, |
| | 30 | + user_id bigint NOT NULL REFERENCES users(id) ON DELETE CASCADE, |
| | 31 | + name text NOT NULL DEFAULT '', |
| | 32 | + fingerprint text NOT NULL, |
| | 33 | + key_id text NOT NULL, |
| | 34 | + armored text NOT NULL, |
| | 35 | + can_sign boolean NOT NULL, |
| | 36 | + can_encrypt_comms boolean NOT NULL, |
| | 37 | + can_encrypt_storage boolean NOT NULL, |
| | 38 | + can_certify boolean NOT NULL, |
| | 39 | + can_authenticate boolean NOT NULL, |
| | 40 | + uids text[] NOT NULL DEFAULT '{}', |
| | 41 | + subkeys jsonb NOT NULL DEFAULT '[]'::jsonb, |
| | 42 | + primary_algo text NOT NULL, |
| | 43 | + created_at timestamptz NOT NULL DEFAULT now(), |
| | 44 | + last_used_at timestamptz, |
| | 45 | + revoked_at timestamptz, |
| | 46 | + expires_at timestamptz, |
| | 47 | + |
| | 48 | + CONSTRAINT user_gpg_keys_name_length CHECK (char_length(name) <= 80), |
| | 49 | + CONSTRAINT user_gpg_keys_fingerprint_format CHECK (fingerprint ~ '^[0-9a-f]{40}$'), |
| | 50 | + CONSTRAINT user_gpg_keys_key_id_format CHECK (key_id ~ '^[0-9a-f]{16}$') |
| | 51 | +); |
| | 52 | + |
| | 53 | +CREATE UNIQUE INDEX user_gpg_keys_fingerprint_uniq |
| | 54 | + ON user_gpg_keys (fingerprint) |
| | 55 | + WHERE revoked_at IS NULL; |
| | 56 | + |
| | 57 | +CREATE INDEX user_gpg_keys_user_id_idx ON user_gpg_keys (user_id, created_at DESC); |
| | 58 | +CREATE INDEX user_gpg_keys_key_id_idx ON user_gpg_keys (key_id); |
| | 59 | + |
| | 60 | +-- +goose Down |
| | 61 | +DROP INDEX IF EXISTS user_gpg_keys_key_id_idx; |
| | 62 | +DROP INDEX IF EXISTS user_gpg_keys_user_id_idx; |
| | 63 | +DROP INDEX IF EXISTS user_gpg_keys_fingerprint_uniq; |
| | 64 | +DROP TABLE IF EXISTS user_gpg_keys; |